php2shell-poc
Five independent RCE chains exploiting PHP's session.uploadprogress and the Zend engine's OOM bailout.
php2shell-poc launched on 21 October 2026. It ranked #82 on Daily Launch on 24 October 2026 with a Launch Score of 21, from +85 stars on 24 Oct on GitHub. It moved down 39 places from the day before.
What is Php2shell Poc?
Five independent RCE chains exploiting PHP's session.uploadprogress and the Zend engine's OOM bailout. 14 years of vulnerable code — PHP 5.4.0 (2012) through 8.5.11. Pre-auth. No application vulnerability required for some chains. Impacts 78% of all websites — including WordPress (43%), Joomla, Drupal, Laravel, Magento, and every default PHP installation.
From its README on GitHub
Php2shell Poc (php2shell-poc) is a repo by ikow on GitHub. It is written in Python and released under the MIT license.
How to get Php2shell Poc
Get it from its repository on GitHub.
In its own words
CVE-2026-109618/109619 — 5 RCE chains + detection rules (Suricata, Sigma, ModSecurity). PHP session.upload_progress pre-auth exploit research.
From its GitHub repository
